Analysis

  • max time kernel
    103s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2025, 06:46

General

  • Target

    6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe

  • Size

    147KB

  • MD5

    9c5698924d4d1881efaf88651a304cb3

  • SHA1

    c60a0b99729eb6d95c2d9f8b76b9714411a3a751

  • SHA256

    6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417

  • SHA512

    1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea

  • SSDEEP

    3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p

Malware Config

Extracted

Path

C:\flzQgniJJ.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: uYrTA6hpRFsWQR0nqlFk5WK8S+zUIHNd9T3L6aykdR27ztPJwC3xHOsdSBkZhmr+yKcnVLCct0ffjVRy5yvFQydzhzQWJR Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

  • Braincipher family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe
    "C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\ProgramData\A7D9.tmp
      "C:\ProgramData\A7D9.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A7D9.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4496

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3027557611-1484967174-339164627-1000\desktop.ini

    Filesize

    129B

    MD5

    69ffd7c33f4691a203147e1e1942db75

    SHA1

    ab648aae0d9fd907176a12132509574d075ddb7b

    SHA256

    5183109229c57ae9fb1f14932dad1acde6369ea2173dcec8ce98604d14aedb4d

    SHA512

    b8c42858a92b111696648a9cb143a0991c0dc384c43e0b73cfdc980bde1559cbeed017b054b7a9e1d150d7f463a94ef70c3627d16fb2f131217106038617222a

  • C:\ProgramData\A7D9.tmp

    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

    Filesize

    147KB

    MD5

    e970c5f8e377591b1ec6ceda97897bc9

    SHA1

    caac1fa8e92b1582b24df6a846c5482cd55c6791

    SHA256

    74bb9761b0637294f6facc1d9103640b96d22ff3cf115957579a1233ea309a37

    SHA512

    3006f1ec88fec832de87992a12717ac358e78aaef368bca46fbe42fbdfe1c5d45ab3d2aede25944a361a13afc23e4557093bd736be11bc30a1efe31f6effac36

  • C:\flzQgniJJ.README.txt

    Filesize

    1KB

    MD5

    3bebb5494e1c3d4753ce92a479e7eda5

    SHA1

    243685d0515d19210e4e2f354d367be6212e98ff

    SHA256

    13d69c85aeb5beab58caefaa2cdc257d668f568103a5cebbd98038b3b66b66bd

    SHA512

    0e31e7bf96fbd6bb91fbe96e59acf96dd0fef5e9db9e93e924afd17fe1066c04b0d9bf9e2d60c335db4f0347107a63d92dfc9ba9b166d2e3151e5440232f63da

  • F:\$RECYCLE.BIN\S-1-5-21-3027557611-1484967174-339164627-1000\DDDDDDDDDDD

    Filesize

    129B

    MD5

    0649dd56de9b6f9caadc2fbf70755cb6

    SHA1

    03ce1503cd3ec9d782ceecc5fbc82cf110941b35

    SHA256

    6cabdbe194a76c7cd4ca6ad1516d577de55bfc276364fe1b19a2927ed12a1baa

    SHA512

    a9227c6930e51bce4b29908421d35b087a6b539e14491ee431eecf60c50c102541152bddbfc4d02f25174ea66c0f3aa9715d1e73616e02df59d95be23cd1a07f

  • memory/512-3635-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/512-1-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/512-3634-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/512-0-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/512-3636-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/512-2-0x0000000002A00000-0x0000000002A10000-memory.dmp

    Filesize

    64KB

  • memory/2244-3640-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

  • memory/2244-3639-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

  • memory/2244-3638-0x00000000024B0000-0x00000000024C0000-memory.dmp

    Filesize

    64KB

  • memory/2244-3637-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

  • memory/2244-3669-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

  • memory/2244-3670-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB